I made a mistake: on a share I configured "force user = xyz" but xyz wasn't in /etc/passwd (misspelling). The result is NT_STATUS_NO_SUCH_USER, which left me clueless in the first place.
I needed to up the log level to 5 to see
"Get_Pwnam_internals didn't find user [xyz]!"
I propose to report this more prominently (on a lower debug level) to make this kind of misconfiguration easier to solve.
Maybe this could be detected by testparm too.